Threats tagged 'ghsa-86rg-2xqg-4p5p'

Google::Auth versions 0.11 through 0.12 for Perl have a vulnerability where the gcloud-auth login callback does not verify the OAuth state parameter. This allows any local process to submit an authorization code, which the CLI exchanges and stores as the user's credentials, causing the user's tools to act as the attacker's account.